Security & Student Data Privacy

Our commitments at a glance

• We do not sell student data. Ever.
• No advertising to students. Study Mondo serves no third-party ads and runs no behavioral ad targeting.
• Education purpose only. Student data is used to operate the learning service for the school — not for unrelated commercial profiling.
• Data minimization. We collect the least we need to run the service.
• School ownership. Under a district agreement, student personal information remains the property of the school/district.
• Deletion on request. Schools can request deletion of their students' data.

Compliance posture

FERPA

When a school uses Study Mondo to deliver instruction, we act as a "school official" with a legitimate educational interest under FERPA's school official exception (34 CFR § 99.31(a)(1)). We use education records only to provide the service to the school and remain under the school's direct control for those records.

COPPA

For students under 13, schools may provide consent on behalf of parents for the use of an educational service for school purposes, consistent with FTC guidance. Teachers who roster students attest that they are authorized to do so. We do not condition participation on the collection of more personal information than is reasonably necessary, and we do not use children's data for behavioral advertising.

State student-privacy laws

Our practices are designed to align with state student data privacy laws (for example California's SOPIPA and similar statutes in other states), including prohibitions on selling student data and on targeted advertising to students.

What we collect & why

• Account data — name and email, used to authenticate the student and associate progress.
• Learning activity — topics studied, quiz/assignment results, mastery, streaks. This powers the teacher dashboard and the student's own progress.
• Limited technical data — standard server logs used for security, reliability, and abuse prevention.

We do not require a student home address, phone number, or government identifiers. We do not process student payment information; paid plans are handled by teachers/parents/administrators through our payment processor.

How we use AI

Study Mondo uses Anthropic's Claude models to power AI tutoring and to assist teachers with assignment feedback. Two points matter for districts:

• Content sent to the AI provider is used to generate the response for that request. Our AI provider does not use data submitted through its commercial API to train its models.
• We design AI prompts to avoid sending unnecessary student identifiers — the model receives the academic context it needs (e.g., the question and the student's answer), not a profile.

Security measures

• Encryption in transit — all traffic is served over HTTPS/TLS.
• Encryption at rest — our database and hosting providers encrypt stored data at rest.
• Access control — application access is role-based (student, teacher, admin); teachers can only see their own classes' data.
• Authentication — passwords are hashed (bcrypt); Google single sign-on is supported; credential sign-in is rate-limited against brute-force attempts.
• Least privilege & managed infrastructure — we run on managed, SOC-2-type cloud infrastructure and limit administrative access.

Subprocessors

We use a small set of vetted infrastructure providers to operate the service. Current subprocessors:

Data retention & deletion

We retain student account and learning data for as long as the account is active or as needed to provide the service to the school. Schools and districts may request export or deletion of their students' data; we will action verified requests promptly. Individual users may also delete their own account from account settings.

Breach response

We maintain procedures to detect, investigate, and respond to security incidents. In the event of a confirmed breach affecting student personal information, we will notify the affected school or district without undue delay and cooperate with the district's obligations under applicable law and any signed agreement.

Data Privacy Agreements

We are happy to review and sign a Data Privacy Agreement with your district, including standard frameworks such as the Student Data Privacy Consortium (SDPC) National DPA and state-specific exhibits. See our Data Privacy Agreement page for how to start.

Contact

Security or privacy questions, DPA requests, or data deletion requests: privacy@studymondo.com. See also our Privacy Policy and Terms of Service.